Google Agent Development Kit Flaws Enabled AI-to-AI CI/CD Exploitation

Researchers disclosed an agent-to-agent exploitation chain in Google’s open-source adk-python repository for the Agent Development Kit, showing how a low-privilege public-facing AI agent handling GitHub issues and pull requests could be prompt-injected into triggering a higher-privilege maintainer-only agent. The attack abused trusted handoffs between agents and GitHub workflow visibility to create a plausible malicious review trail, potentially steering maintainers toward merging poisoned pull requests and opening a software supply-chain compromise path.

The researchers also reported a second weakness in Antigravity SDK-based automation, where a command allowlist could be bypassed through Git scripting features to achieve remote code execution on the CI runner. Because the runner reportedly exposed a long-lived personal access token and Google Cloud service account credentials, even an unprivileged GitHub issue could have enabled secret exfiltration. Google said it fixed and hardened the repository and credited the report, while declining a bug-bounty payout because successful exploitation still depended on social engineering and maintainer action.